zafiro-qa

zafiro-qa is a skill for Claude Code, Codex from niki914/zafiro. It costs 71 tokens per session (1,783 once invoked), scanned A, original, MIT.

An Android quality-assurance workflow for testing the Zafiro app on a real phone or emulator. It uses one installed app as the test controller and a separate debug app as the app under test, with screenshots, device actions, settings, and logs.

In plain words
What is it for?
Running end-to-end checks, controlling the Android device, taking screenshots, injecting test settings, collecting logs, and verifying behavior.
Why use it?
It provides a defined way to check the debug build without disrupting the release app that supplies the testing connection. It also keeps test data and operations separated between the two app versions.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is adb shell "run-as com.niki914.zafiro.debug tar -czf - files/logs/" | tar -xzf - -C ./debug_logs/.

Good fit Running end-to-end checks, controlling the Android device, taking screenshots, injecting test settings, collecting logs, and verifying behavior.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/niki914/zafiro
agentmods
npx agentmods add skills/niki914/zafiro/zafiro-qa

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for zafiro-qa

README.md
[![agentmods](https://agentmods.dev/badge/skills/niki914/zafiro/zafiro-qa/github.svg)](https://agentmods.dev/skills/niki914/zafiro/zafiro-qa)
Your own site
<a href="https://agentmods.dev/skills/niki914/zafiro/zafiro-qa"><img src="https://agentmods.dev/badge/skills/niki914/zafiro/zafiro-qa/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for zafiro-qa

Your own site · 80×15
<a href="https://agentmods.dev/skills/niki914/zafiro/zafiro-qa"><img src="https://agentmods.dev/badge/skills/niki914/zafiro/zafiro-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 71 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,783 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00071 $0.01783
Opus 5.5 $0.00028 $0.00713
Sonnet 5.5 $0.00014 $0.00357
Haiku 4.5 $0.00007 $0.00178

Measured today against content hash 879eb4110f4f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

zafiro-qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

在 PC 侧通过 `curl` 检查端点健康度:
.agents/skills/zafiro-qa/SKILL.md · 123 lines

How it starts

The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Zafiro QA

通过真机已部署的 Release 版 Zafiro(提供 MCP 服务),驱动手机自动化测试与状态验证,对开发中的 Debug 版 Zafiro 进行功能 QA。

核心架构与操作红线

本项目在真机上采用 双包共存(Dual-App)架构:

版本 包名 职责 关键要求
Release 版 com.niki914.zafiro 测试基础设施:在后台提供 Zafiro MCP 服务(端口 8791),作为 Agent 操控手机的手和眼。 【绝对红线】严禁 kill、uninstall 或清空 Release 版数据,任何导致 Release 版退出的操作都会直接打断 MCP 连接!
Debug 版 com.niki914.zafiro.debug 被测目标(SUT):包含当前分支最新代码、新开发工具或待测修复,有独立的沙箱数据与日志目录。 所有环境注入(配置/设置)、UI 操控演练、日志拉取与断言,均只针对 Debug 版。

心智模型:“坐在 Release 版(MCP 遥控器)上,伸手去测 Debug 版(被测目标)”。

本文档所涉及的任何操作手机的行为:安装、触控和截屏等,必须有用户的授权才可执行!


阶段一:MCP 服务感知与就绪准备

在开始执行测试动作前,必须确认 Harness(宿主环境)是否已感知到 zafiro MCP 服务。

1. 感知判断

[NOTE] 这一步无须读取任何配置,问问自己,自己是否有这些工具,如果没有,则是没感知到,无须通过任何配置文件判断这一点

检查当前环境中是否存在 zafiro 相关的 MCP 工具(如 zafiro_screenshot、zafiro_launch_app、zafiro_load_skill、screenshot 等):

  • 若能直接感知到:说明连接正常,直接跳到 阶段二 开始测试。
  • 若无法感知到:按以下步骤建立端口转发并等待注入。

2. 建立 ADB 端口转发

Release 版 Zafiro 内置的 MCP HTTP 服务默认监听在 Android 设备的 8791 端口。

在 PC 终端执行端口转发:

adb forward tcp:8791 tcp:8791

3. 验证端点连通性

在 PC 侧通过 curl 检查端点健康度:

curl -I -s http://127.0.0.1:8791/mcp
  • 若返回 HTTP 响应(通常为 400 或 405 等非连接拒绝状态),证明链路已通;
  • 若出现 Connection refused,应停止操作并建议用户检查手机上 Release 版 Zafiro 是否在前台或后台存活。

4. 停下等待注入(重要)

当 curl 验证通过但当前 Agent 仍未感知到 MCP 工具时: 必须停下并提示用户:“已完成 adb forward (端口 8791),端点连通正常。请确认在当前 Harness 中注入/重载 zafiro MCP 服务后继续。”


阶段二:双轨协同测试手段

MCP 就绪后,结合 “MCP 远程驱动” 与 “ADB 沙箱底座” 两种手段进行全方位 QA。

轨道 A:通过 MCP 驱动与验证功能

  1. 加载手机控制能力: 在需要进行界面交互(点击、滑动、输入、截屏)前,必须优先调用 Zafiro MCP 上的 load_skill:

    {
      "name": "phone-use"
    }
    

    加载完成后,即可解锁无障碍层与 Shell 层的点击、长按、滑动、输入以及真机截图能力。

  2. UI 场景自动化操控:

    • 启动被测 Debug 应用:launch_app(packageName="com.niki914.zafiro.debug");
    • 观察当前界面:调用 screenshot 获取屏幕画面(必要时结合 view_image 查看);
    • 模拟用户交互:通过无障碍节点或坐标操作按钮、输入文本、切换对话。
  3. Tool 表现端到端验证: 正在开发/修复某个 Tool(如 Python 脚本工具、内置工具)时,无需在手机上人工手动点测,直接通过 MCP 调用该工具,检验其输入输出、异常处理和落盘状态是否符合预期。

Read the full file on GitHub · 123 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 123 lines · 71 tokens per session scan A 879eb4110f4f

Subscribe to this mod's changes

zafiro-qa is a skill published in the GitHub repository niki914/zafiro (274 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 1,783 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.

Related

Other skills, from other repositories

mobile-automation

Control Android and iOS devices, emulators and simulators — launch apps, tap, swipe, type, take screenshots, read the accessibility tree. Use when a task involves a mobile device or app, mobile UI testing, or reproducing a bug on a phone.

mobile-next/mobile-mcp · 58 tokens

feature-builder

End-to-end mobile feature builder. Takes a feature from description to fully running code with E2E tests through six phases - planning, architecture review, implementation, testing, build-fix, quality gate, and verification. Supports Android, iOS, and KMP with platform auto-detection.

ahmed3elshaer/everything-claude-code-mobile · 62 tokens

android-ui-journey-testing

XML-specified Android UI journey testing, interactive step execution, assertion verification, and JSON outcome reporting.

sickn33/agentic-awesome-skills · 27 tokens

reproduce-bug

Reproduce a reported bug in googleapis/mcp-toolbox and decide whether it is real, delivering an evidence-backed verdict: confirmed, already fixed, misconfiguration, client-side, works as intended, not reproducible, or blocked. Use whenever a maintainer asks you to reproduce, verify, confirm, or investigate a bug…

googleapis/mcp-toolbox · 130 tokens

solopi-ai

A command-line framework for testing Android apps and devices with SoloPi, including on-device or cloud AI decision models. It manages devices, test cases, recorded interactions, replays, performance history, and evidence.

alipay/SoloPi · 82 tokens

langbot-testing

Test LangBot WebUI and core product flows with an automated browser and backend logs. Use when validating the configured LangBot frontend, pipeline Debug Chat, model provider setup and test buttons, bot and knowledge-base UI flows, or troubleshooting failed LangBot end-to-end tests.

langbot-app/LangBot · 58 tokens